dllhost[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dllhost.exe
Size 48KB
Sample260711-fv3p8aet21
SHA256 69ff5edf55fedcb8e76152d53423a8e3091d936e50b894aba9d0bda29610a2b9
MD5 26a44aaa75bfa30fd1defe07897b39bd
SHA1 fcc2c33447593b63d2ff36c3225c6a59b9816f74
SHA512 92b71964611eb379aed561459db5070d7bd55d8d30ef5f7500b03652a81e775fab1bc078aa6cfb451a006bac40d752739af0c7239c3879da8a00f71b1af5bf24
SSDEEP 768:kW9iYl+pHyCcBU2VLIDVlhpywPHZdTaHk1MlnEWV0NXhNh1PQ9zguIh5j:59iYl+pHc+2eplhpB5dWYi0NzPYzH05j
TLSH
T105236C62AD8C41B1DDE439B842AEB063557ED2C8071486D35F24ABE5E9E53C0EB341FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

dllhost.exe

.exe 48KB

dllhost.exe

IMPHASH c3825dc8139b368da2a6dae1569ba7fd
SHA256 69ff5edf55fedcb8e76152d53423a8e3091d936e50b894aba9d0bda29610a2b9
MD5 26a44aaa75bfa30fd1defe07897b39bd
SHA1 fcc2c33447593b63d2ff36c3225c6a59b9816f74
SHA512 92b71964611eb379aed561459db5070d7bd55d8d30ef5f7500b03652a81e775fab1bc078aa6cfb451a006bac40d752739af0c7239c3879da8a00f71b1af5bf24
SSDEEP 768:kW9iYl+pHyCcBU2VLIDVlhpywPHZdTaHk1MlnEWV0NXhNh1PQ9zguIh5j:59iYl+pHc+2eplhpB5dWYi0NzPYzH05j
TLSH
T105236C62AD8C41B1DDE439B842AEB063557ED2C8071486D35F24ABE5E9E53C0EB341FE
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

b6:f2:6d:ad:72:90:27:7d:1c:67:4d:64:65:59:ec:52:8b:ed:db:5d:46:44:0c:3b:c1:f3:ce:b3:3d:db:8c:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 17, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

31504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dllhost.pdb

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__controlfp_s _o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function memmove _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o_exit _o_free _o_terminate __current_exception __current_exception_context _except_handler4_common _o___p__commode memcmp memcpy

api-ms-win-crt-string-l1-1-0

memset

ntdll

NtSetInformationProcess

api-ms-win-core-com-private-l1-1-0

CoRegisterSurrogateEx

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW GetModuleHandleExW GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive ReleaseMutex CreateMutexExW WaitForSingleObjectEx InitializeCriticalSectionEx LeaveCriticalSection AcquireSRWLockShared OpenSemaphoreW ReleaseSemaphore DeleteCriticalSection EnterCriticalSection CreateSemaphoreExW WaitForSingleObject ReleaseSRWLockShared AcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapSetInformation HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError UnhandledExceptionFilter GetLastError SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetCurrentProcess TerminateProcess GetCurrentThreadId GetStartupInfoW

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeEx IIDFromString

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-1

SetProcessMitigationPolicy IsProcessorFeaturePresent

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

Sharing

General

Malware Config

Signatures

File Explorer

dllhost.exe

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-com-private-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

generic